Adding USBGuard to checks for USB Devices. (#499)

* Added kernel.dmesg_restrict to sysctl checks.

* Initial addition of tests_usb_devices

* More updates for tests_usb_devices

* More updates

* Updated logging and other output.

4 files changed, 272 insertions, 1 deletions

diff --git a/include/binaries b/include/binaries
index 95813686..1c56607b 100644
--- a/include/binaries
+++ b/include/binaries
@@ -220,6 +220,7 @@
                             tune2fs)                TUNE2FSBINARY="${BINARY}";         LogText "  Found known binary: tune2fs (file system tool) - ${BINARY}" ;;
                             uname)                  UNAMEBINARY="${BINARY}";           LogText "  Found known binary: uname (operating system details) - ${BINARY}" ;;
                             uniq)                   UNIQBINARY="${BINARY}";            LogText "  Found known binary: uniq (text manipulation utility) - ${BINARY}";;
+                            usbguard)               USBGUARDBINARY="${BINARY}";        LogText "  Found known binary: usbguard (USB security tool) - ${BINARY}" ;;
                             vgdisplay)              VGDISPLAYBINARY="${BINARY}";       LogText "  Found known binary: vgdisplay (LVM tool) - ${BINARY}" ;;
                             vmtoolsd)               VMWARETOOLSDBINARY="${BINARY}";    LogText "  Found known binary: vmtoolsd (VMWare tools) - ${BINARY}" ;;
                             wc)                     WCBINARY="${BINARY}";              LogText "  Found known binary: wc (word count) - ${BINARY}" ;;
diff --git a/include/consts b/include/consts
index e5c0b4b0..4bb55a3a 100644
--- a/include/consts
+++ b/include/consts
@@ -283,6 +283,10 @@ unset LANG
     UPLOAD_PROXY_SERVER=""
     UPLOAD_TOOL=""
     UPLOAD_TOOL_ARGS=""
+    USBGUARDFOUND=0
+    USBGUARDBINARY=""
+    USBGUARD_CONFIG=""
+    USBGUARD_ROOT=""
     VALUE=""
     VERBOSE=0
     VGDISPLAYBINARY=""
diff --git a/include/tests_usb_devices b/include/tests_usb_devices
new file mode 100644
index 00000000..64e80aaf
--- /dev/null
+++ b/include/tests_usb_devices
@@ -0,0 +1,266 @@
+#!/bin/sh
+
+#################################################################################
+#
+#   Lynis
+# ------------------
+#
+# Website  : https://cisofy.com
+# Blog     : http://linux-audit.com
+# GitHub   : https://github.com/CISOfy/lynis
+#
+# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+#################################################################################
+#
+#  USB Devices
+#
+#################################################################################
+#
+
+    USBGUARD_FOUND=0
+    USBGUARD_CONFIG=""
+    USBGUARD_RULES=""
+    USBGUARD_RESTORE_POLICY=""
+    USBGUARD_CONTROLLER_POLICY=""
+    USBGUARD_DEVICE_POLICY=""
+    USBGUARD_INSERTED_POLICY=""
+    USBGUARD_DEFAULT_POLICY=""
+    USBGUARD_RULES_ALLOW=0
+    USBGUARD_RULES_BLOCK=0
+    USBGUARD_RULES_REJECT=0
+
+#
+#################################################################################
+#
+    InsertSection "USB Devices"
+#
+#################################################################################
+#
+
+    # PLACEHOLDER USB-0000 used until a good test name & number can be assigned.
+    # Once that is done, we are one step closer to being able to enable the
+    # suggestions below.
+
+    # Test        : USB-0000
+    # Description : Perform file permissions check
+    Register --test-no USB-0000  --os Linux --weight L --network NO --category security --description "Check for presence of USBGuard"
+    if [ ${SKIPTEST} -eq 0 ]; then
+
+        if [ ! -z "${USBGUARDBINARY}" ]; then
+            USBGUARD_FOUND=1
+            LogText "Result: USBGuard is installed (${USBGUARDBINARY})"
+            Display --indent 2 --text "- Checking USBGuard" --result "${STATUS_FOUND}" --color GREEN
+            AddHP 1 1
+
+            LogText "Checking USBGuard configuration file"
+            if [ -f /etc/usbguard/usbguard-daemon.conf ]; then
+                USBGUARD_CONFIG="/etc/usbguard/usbguard-daemon.conf"
+            else
+                USBGUARD_CONFIG=""
+            fi
+
+            if [ ! -z "${USBGUARD_CONFIG}" ]; then
+                LogText "Result: USBGuard configuration found (${USBGUARD_CONFIG})"
+                Display --indent 4 --text "- Configuration" --result "${STATUS_FOUND}" --color GREEN
+                AddHP 1 1
+
+                LogText "Checking USBGuard restore controller device state (RestoreControllerDeviceState)"
+                USBGUARD_RESTORE_POLICY=$(${AWKBINARY} -F '=' -v OPT="RestoreControllerDeviceState" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG})
+                if [ ! -z "${USBGUARD_RESTORE_POLICY}" ]; then
+                    LogText "Result: RestoreControllerDeviceState = ${USBGUARD_RESTORE_POLICY}"
+                    case "${USBGUARD_RESTORE_POLICY}" in
+                        "true")
+                            Display --indent 6 --text "- Restore controller device state" --result "${USBGUARD_RESTORE_POLICY}" --color YELLOW
+                            LogText "  Consider changing RestoreControllerDeviceState to \"false\""
+                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "RestoreControllerDeviceState (${USBGUARD_RESTORE_POLICY} --> false)"
+                            AddHP 0 1
+                            ;;
+                        "false")
+                            Display --indent 6 --text "- Restore controller device state" --result "${USBGUARD_RESTORE_POLICY}" --color GREEN
+                            AddHP 1 1
+                            ;;
+                        *)
+                            LogText "Result: Invalid configuration for RestoreControllerDeviceState"
+                            Display --indent 6 --text "- Restore controller device state" --result "Invalid" --color RED
+                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "RestoreControllerDeviceState invalid \"${USBGUARD_RESTORE_POLICY}\""
+                            AddHP 0 1
+                            ;;
+                    esac
+
+                else
+                    LogText "Result: RestoreControllerDeviceState not found"
+                    Display --indent 6 --text "- Restore controller device state" --result "NOT FOUND" --color WHITE
+                    AddHP 0 1
+                fi
+
+                LogText "Checking USBGuard rule for controllers connected before daemon starts (PresentControllerPolicy)"
+                USBGUARD_CONTROLLER_POLICY=$(${AWKBINARY} -F '=' -v OPT="PresentControllerPolicy" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG})
+                if [ ! -z "${USBGUARD_CONTROLLER_POLICY}" ]; then
+                    LogText "Result: PresentControllerPolicy = ${USBGUARD_CONTROLLER_POLICY}"
+                    case "${USBGUARD_CONTROLLER_POLICY}" in
+                        "allow"|"keep")
+                            Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "${USBGUARD_CONTROLLER_POLICY}" --color YELLOW
+                            LogText "  Consider changing PresentControllerPolicy to \"apply-policy\", \"block\" or \"reject\""
+                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "PresentControllerPolicy (${USBGUARD_CONTROLLER_POLICY} --> (apply-policy|block|reject)"
+                            AddHP 0 1
+                            ;;
+                        "apply-policy"|"block"|"reject")
+                            Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "${USBGUARD_CONTROLLER_POLICY}" --color GREEN
+                            AddHP 1 1
+                            ;;
+                        *)
+                            LogText "Result: Invalid configuration for PresentControllerPolicy"
+                            Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "Invalid" --color RED
+                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "PresentControllerPolicy invalid \"${USBGUARD_CONTROLLER_POLICY}\""
+                            AddHP 0 1
+                            ;;
+                    esac
+                else
+                    LogText "Result: PresentControllerPolicy not found"
+                    Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "NOT FOUND" --color WHITE
+                    AddHP 0 1
+                fi
+
+                LogText "Checking USBGuard rule for devices connected before daemon starts (PresentDevicePolicy)"
+                USBGUARD_DEVICE_POLICY=$(${AWKBINARY} -F '=' -v OPT="PresentDevicePolicy" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG})
+                if [ ! -z "${USBGUARD_DEVICE_POLICY}" ]; then
+                    LogText "Result: PresentDevicePolicy = ${USBGUARD_DEVICE_POLICY}"
+                    case "${USBGUARD_DEVICE_POLICY}" in
+                        "allow"|"keep")
+                            Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "${USBGUARD_DEVICE_POLICY}" --color YELLOW
+                            LogText "  Consider changing PresentDevicePolicy to \"apply-policy\", \"block\" or \"reject\""
+                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "PresentDevicePolicy (${USBGUARD_DEVICE_POLICY} --> (apply-policy|block|reject)"
+                            AddHP 0 1
+                            ;;
+                        "apply-policy"|"block"|"reject")
+                            Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "${USBGUARD_DEVICE_POLICY}" --color GREEN
+                            AddHP 1 1
+                            ;;
+                        *)
+                            LogText "Result: Invalid configuration for PresentDevicePolicy"
+                            Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "Invalid" --color RED
+                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "PresentDevicePolicy invalid \"${USBGUARD_DEVICE_POLICY}\""
+                            AddHP 0 1
+                            ;;
+                    esac
+                else
+                    LogText "Result: PresentDevicePolicy not found"
+                    Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "NOT FOUND" --color WHITE
+                    AddHP 0 1
+                fi
+
+                LogText "Checking USBGuard rule for devices inserted after daemon starts (InsertedDevicePolicy)"
+                USBGUARD_INSERTED_POLICY=$(${AWKBINARY} -F '=' -v OPT="InsertedDevicePolicy" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG})
+                if [ ! -z "${USBGUARD_INSERTED_POLICY}" ]; then
+                    LogText "Result: InsertedDevicePolicy = ${USBGUARD_INSERTED_POLICY}"
+                    case "${USBGUARD_INSERTED_POLICY}" in
+                        "allow"|"keep")
+                            Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "${USBGUARD_INSERTED_POLICY}" --color YELLOW
+                            LogText "  Consider changing InsertedDevicePolicy to \"apply-policy\", \"block\" or \"reject\""
+                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "InsertedDevicePolicy (${USBGUARD_INSERTED_POLICY} --> (apply-policy|block|reject)"
+                            AddHP 0 1
+                            ;;
+                        "apply-policy"|"block"|"reject")
+                            Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "${USBGUARD_INSERTED_POLICY}" --color GREEN
+                            AddHP 1 1
+                            ;;
+                        *)
+                            LogText "Result: Invalid configuration for InsertedDevicePolicy"
+                            Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "Invalid" --color RED
+                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "InsertedDevicePolicy invalid \"${USBGUARD_INSERTED_POLICY}\""
+                            AddHP 0 1
+                            ;;
+                    esac
+                else
+                    LogText "Result: InsertedDevicePolicy not found"
+                    Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "NOT FOUND" --color WHITE
+                    AddHP 0 1
+                fi
+
+                LogText "Checking USBGuard rule for devices not in RuleFile (ImplicitPolicyTarget)"
+                USBGUARD_DEFAULT_POLICY=$(${AWKBINARY} -F '=' -v OPT="ImplicitPolicyTarget" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG})
+                if [ ! -z "${USBGUARD_DEFAULT_POLICY}" ]; then
+                    LogText "Result: ImplicitPolicyTarget = ${USBGUARD_DEFAULT_POLICY}"
+                    case "${USBGUARD_DEFAULT_POLICY}" in
+                        "allow")
+                            Display --indent 6 --text "- Rule for devices not in RuleFile" --result "${USBGUARD_DEFAULT_POLICY}" --color YELLOW
+                            LogText "  Consider changing ImplicitPolicyTarget to \"block\" or \"reject\""
+                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "ImplicitPolicyTarget (${USBGUARD_DEFAULT_POLICY} --> (block|reject)"
+                            AddHP 0 1
+                            ;;
+                        "block"|"reject")
+                            Display --indent 6 --text "- Rule for devices not in RuleFile" --result "${USBGUARD_DEFAULT_POLICY}" --color GREEN
+                            AddHP 1 1
+                            ;;
+                        *)
+                            LogText "Result: Invalid configuration for ImplicitPolicyTarget"
+                            Display --indent 6 --text "- Rule for devices not in RuleFile" --result "Invalid" --color RED
+                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "ImplicitPolicyTarget invalid \"${USBGUARD_DEFAULT_POLICY}\""
+                            AddHP 0 1
+                            ;;
+                    esac
+                else
+                    LogText "Result: ImplicitPolicyTarget not found"
+                    Display --indent 4 --text "- Rule for devices not in RuleFile" --result "NOT FOUND" --color WHITE
+                    AddHP 0 1
+                fi
+
+                LogText "Checking RuleFile"
+                USBGUARD_RULES=$(${AWKBINARY} -F '=' -v OPT="RuleFile" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG})
+                if [ ! -z "${USBGUARD_RULES}" ] && [ -f "${USBGUARD_RULES}" ]; then
+                    LogText "Result: RuleFile found (${USBGUARD_RULES})"
+                    Display --indent 4 --text "- RuleFile" --result "${STATUS_FOUND}" --color GREEN
+                    AddHP 1 1
+
+                    USBGUARD_RULES_ALLOW=$(${EGREPBINARY} -c "^allow" ${USBGUARD_RULES})
+                    Display --indent 6 --text "- Controllers & Devices allow" --result "${USBGUARD_RULES_ALLOW}" --color WHITE
+                    USBGUARD_RULES_BLOCK=$(${EGREPBINARY} -c "^block" ${USBGUARD_RULES})
+                    Display --indent 6 --text "- Controllers & Devices block" --result "${USBGUARD_RULES_BLOCK}" --color WHITE
+                    USBGUARD_RULES_REJECT=$(${EGREPBINARY} -c "^reject" ${USBGUARD_RULES})
+                    Display --indent 6 --text "- Controllers & Devices reject" --result "${USBGUARD_RULES_REJECT}" --color WHITE
+                else
+                    LogText "Result: RuleFile not found (\"man usbguard\" for instructions to install initial policies)"
+                    Display --indent 4 --text "- RuleFile" --result "${STATUS_NOT_FOUND}" --color RED
+                    # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                    ReportSuggestion ${TEST_NO} "Install USBGuard RuleFile" "\"man usbguard\" for instructions to install initial policies"
+                    AddHP 0 1
+                fi
+
+            else
+                Display --indent 4 --text "- Configuration" --result "${STATUS_NOT_FOUND}" --color WHITE
+                LogText "Result: Configuration not found"
+                # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                #ReportSuggestion ${TEST_NO} "USBGuard configuration file not found, consider reinstalling"
+                AddHP 0 7
+            fi
+        else
+            LogText "Result: USBGuard not found"
+            Display --indent 2 --text "- Checking USBGuard" --result "${STATUS_NOT_FOUND}" --color WHITE
+            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+            #ReportSuggestion ${TEST_NO} "Install USBGuard to allow for fine-grained control of USB authorization"
+            AddHP 0 8
+        fi
+
+    fi
+
+#
+#################################################################################
+#
+
+WaitForKeyPress
+
+#
+#================================================================================
diff --git a/lynis b/lynis
index ab277235..2b8e9168 100755
--- a/lynis
+++ b/lynis
@@ -925,7 +925,7 @@ ${NORMAL}
             LogText "Info: perform tests from all categories"
 
             INCLUDE_TESTS="boot_services kernel memory_processes authentication shells \
-                           filesystems storage storage_nfs nameservices ports_packages networking printers_spools \
+                           filesystems usb_devices storage storage_nfs nameservices ports_packages networking printers_spools \
                            mail_messaging firewalls webservers ssh snmp databases ldap php squid logging \
                            insecure_services banners scheduling accounting time crypto virtualization containers \
                            mac_frameworks file_integrity tooling malware file_permissions homedirs \